3 Commits

Include renames

Author	SHA1	Message	Date
araharah-executor	22fda6d12a	fix(03-04): HMAC data-check-string excludes only hash — signature field participates (real clients rejected as tampered; erratum M6)	2026-10-23 01:34:19 +08:00
araharah-executor	3ea1fdd932	fix(02-bot-skeleton-initdata-security): WR-02 fail-closed /telegram/webhook — unarmed WEBHOOK_SECRET rejects (constant 500, category-only log) before grammY's accept-everything compare	2026-10-22 20:18:34 +08:00
araharah-executor	8995498bff	fix(02-bot-skeleton-initdata-security): WR-01 cap /api/session body at 4 KB before JSON split (413, category-only logs)	2026-10-22 20:17:34 +08:00